CVE-2026-47040
A critical flaw in Oracle Net Services lets attackers gain unauthorized access to data and cause service crashes. The vulnerability is easy to exploit over the network and can lead to data theft or denial of service. It affects Oracle Database Server versions 19.3‑19.31, 21.3‑21.22 and 23.4.0‑23.26.2.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Database Server users running Oracle Net Services component versions 19.3‑19.31, 21.3‑21.22, or 23.4.0‑23.26.2. Typical users include database administrators and enterprises that rely on Oracle databases for critical applications.
Real-world impact
An unauthenticated attacker with network access can read or modify sensitive data, gain full control over Oracle Net Services, and repeatedly crash the service, causing downtime.
Why this severity
The CVSS score of 9.1 reflects the high impact on confidentiality (loss of sensitive data) and availability (service crashes), combined with the fact that the vulnerability is easy to exploit and requires no user interaction.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources